SAP security note 1508969, "Unauthorized usage of application functionality in SRM". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An unauthorized and unauthenticated third party can exploit the system to perform actions in SRM-SUS (Supplier Self-Services) as if they were an authorized user.
Solution
To remediate this issue, you need to apply the appropriate Support Package (SP) or follow the correction instructions provided in the note. Detailed steps are outlined in the manual activities section of the note.
Reason and prerequisites
In certain scenarios, the vulnerability allows third parties to bypass authentication mechanisms, enabling them to perform actions within the SRM system without proper authorization.
CVSS
Score 0
References
Affected components
- SRM_SERVER 500
- SRM_SERVER 550
- SRM_SERVER 600
- SRM_SERVER 700
- SRM_SERVER 701
Full note on SAP: SAP Support Launchpad note 1508969
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].